Known vulnerabilities in Craft CMS - page 7

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 137
Public exploits: 13
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 137 known vulnerabilities: 1 critical, 13 high, 50 medium, 73 low Critical High Medium Low

Vulnerabilities (137)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU76598 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-33194
CWE-79 Low
No
No
3.8.6, 4.4.6 29.05.2023 SB2023052913
#VU76597 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-33195
CWE-79 Low
No
No
4.4.6 29.05.2023 SB2023052913
#VU76596 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-33197
CWE-79 Low
No
No
4.4.6 29.05.2023 SB2023052913
#VU76584 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-33196
CWE-79 Low
No
No
4.4.7 26.05.2023 SB2023052639
#VU76399 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-2817
CWE-79 Low
No
No
4.4.11 22.05.2023 SB2023052206
#VU76378 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-32679
CWE-94 Medium
No
No
4.4.6 19.05.2023 SB2023051932
#VU126471 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-31144
CWE-79 Medium
No
No
3.8.4, 4.4.4 05.05.2023 SB2023050534
#VU73794 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-23927
CWE-79 Low
No
No
4.3.7 20.03.2023 SB2023032001
#VU126470 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-28378
CWE-79 Medium
No
No
3.7.29 04.04.2022 SB2022040438
#VU57058 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-41824
CWE-94 Medium
No
No
3.7.14 05.10.2021 SB2021100510
#VU54558 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-27902
CWE-79 Low
No
No
3.6.0 05.07.2021 SB2021070515
#VU54557 - Session Fixation
CVE-2021-27903
CWE-384 High
No
No
3.6.7 05.07.2021 SB2021070514
#VU53291 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-32470
CWE-79 Low
No
No
3.6.13 17.05.2021 SB2021051701
#VU34922 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-9554
CWE-79 Low
Available
No
- 31.12.2019 SB2019123136
#VU35824 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-12823
CWE-79 Low
No
No
- 18.06.2019 SB2019061822
#VU36272 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-20418
CWE-79 Low
Available
No
- 24.12.2018 SB2018122412
#VU9828 - Unrestricted Upload of File with Dangerous Type
CVE-2018-3814
CWE-434 Medium
No
No
- 01.01.2018 SB2018010205


Showing elements 121 - 140 out of 137